authorgravatar for 124872+jedisct1@users.noreply.github.comFrank Denis <124872+jedisct1@users.noreply.github.com> 2025-02-17 18:56:09+01:00
committergravatar for noreply@github.comGitHub <noreply@github.com> 2025-02-17 17:56:09+00:00
log55c46870b23ac16670beaa3ff1c082b703738307
tree41c94888341184b9205b8adf769ec7e386fddfc6
parent1b62469ec93f78dbcebc90187eb9be795986d66f
signaturebadge-check Signed by PGP key B5690EEEBB952194

crypto.auth.Aegis128X*Mac: properly absorb tags in the first lane (#22922)

In the MAC finalization function, concatenated tags at odd positions were not absorbed into the correct lane. Spotted by a Tigerbeetle regression test and reported by Rafael Batiati (@batiati) — Thanks!

1 files changed, 8 insertions(+), 6 deletions(-)

lib/std/crypto/aegis.zig+8-6
......@@ -219,7 +219,8 @@ fn State128X(comptime degree: u7) type {
219219 128 => {
220220 const tags = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).xorBlocks(blocks[4]).xorBlocks(blocks[5]).xorBlocks(blocks[6]).toBytes();
221221 for (0..degree / 2) |d| {
222 v[0..32].* = tags[d * 32 ..][0..32].*;
222 v[0..16].* = tags[d * 32 ..][0..16].*;
223 v[rate / 2 ..][0..16].* = tags[d * 32 ..][16..32].*;
223224 state.absorb(&v);
224225 }
225226 },
......@@ -227,7 +228,8 @@ fn State128X(comptime degree: u7) type {
227228 const tags_0 = blocks[0].xorBlocks(blocks[1]).xorBlocks(blocks[2]).xorBlocks(blocks[3]).toBytes();
228229 const tags_1 = blocks[4].xorBlocks(blocks[5]).xorBlocks(blocks[6]).xorBlocks(blocks[7]).toBytes();
229230 for (1..degree) |d| {
230 v[0..32].* = tags_0[d * 16 ..][0..16].* ++ tags_1[d * 16 ..][0..16].*;
231 v[0..16].* = tags_0[d * 16 ..][0..16].*;
232 v[rate / 2 ..][0..16].* = tags_1[d * 16 ..][0..16].*;
231233 state.absorb(&v);
232234 }
233235 },
......@@ -1013,13 +1015,13 @@ test "AEGISMAC-128* test vectors" {
10131015
10141016 Aegis128X2Mac.createWithNonce(&mac256, &msg, &key, &nonce);
10151017 Aegis128X2Mac_128.createWithNonce(&mac128, &msg, &key, &nonce);
1016 try htest.assertEqual("7aa41edfd57a95c1108d83c63b8d4d01", &mac128);
1017 try htest.assertEqual("55b6449929cd2b01d04786e57698b3ddfb5cbf6e421bbd022637a33d60f40294", &mac256);
1018 try htest.assertEqual("6873ee34e6b5c59143b6d35c5e4f2c6e", &mac128);
1019 try htest.assertEqual("afcba3fc2d63c8d6c7f2d63f3ec8fbbbaf022e15ac120e78ffa7755abccd959c", &mac256);
10181020
10191021 Aegis128X4Mac.createWithNonce(&mac256, &msg, &key, &nonce);
10201022 Aegis128X4Mac_128.createWithNonce(&mac128, &msg, &key, &nonce);
1021 try htest.assertEqual("46a194ea4337bb32c2186a99e312f3a7", &mac128);
1022 try htest.assertEqual("ea884072699569532fb68ae9fb2653c9ffef3e974333d3a17d77be02453cc12f", &mac256);
1023 try htest.assertEqual("c45a98fd9ab8956ce616eb008cfe4e53", &mac128);
1024 try htest.assertEqual("26fdc76f41b1da7aec7779f6e964beae8904e662f05aca8345ae3befb357412a", &mac256);
10231025}
10241026
10251027test "AEGISMAC-256* test vectors" {